Wappalyzer: Removal of never detected applications

Created on 13 Mar 2017  Â·  58Comments  Â·  Source: AliasIO/wappalyzer

At some point I'd like to remove applications that have had very few detections over a certain period of time. Quite a few have never been identified on any website:

https://www.wappalyzer.com/applications/websites

Website

All 58 comments

re: SailsJS -- is the header detection portion case sensitive?

https://www.scoutlit.com/

x-powered-by:Sails <sailsjs.org>

The pattern needs to be updated "X-Powered-By": "^Sails$"

But I wasn't sure if the X-Powered-By portion was case sensitive, please advise.

This is incorrect statistics.
1C-Bitrix is popular CMS. I've detected enough sites running on it over the past month.

@AlexByte Do you have sharing of detections disabled or enabled?
image

@AlexByte I checked https://www.1c-bitrix.ru/ and it was detected by Wappalyzer. I guess I'll wait a day or two to see if the metrics logged the detection.

@craiglondon Sharing of detections is enabled.

Strange. Can you provide a few examples of sites that use this CMS? I detected it in Chrome on the CMS homepage. But I don't know any other sites that use it.

@alexbyte ^^^

There is a threshold for data to be displayed on the website. I'm happy to leave 1C-Bitrix in but it looks like not many Wappalyzer users encounter it.

Why not add the option for whose who want to track all applications?

The motivation for removing these applications is to remove bloat.

Whats the problem with apps.json? I guess its size is not very large, no problems with size on disk and opening.

It would mainly be to reduce processing, i.e. the number of regular expressions evaluated on every page.

Why not add the option for whose who want to track all applications?

What is the minimum number of an application users to show their URLs on Wappalyzer website?

The applications needs to be detected on at least 100 websites to be displayed.

@AliasIO Is there a threshold of the number of users?

No, there isn't.

Why did you close this issue @AliasIO ? Shall I open a new one to discuss technologies that might be good removal candidates?

Ah, didn't mean to close this one. Something about the numbers seems off, not sure why Lodash has zero detections for instance.

I'd like to propose to remove asymptix, that has not seen a single significant detection, and has 3 stars on github, and is here since fb7be84cfbb6b36ae3d68a147147571b9135d273, 18 months ago.

Go for it.

I propose to have two files. One with the most common applications and one with others. User could select if want to detect un-common applications too.

@AliasIO Why can it be that I detected the technology on several sites, and the site says that the technology is used on 0 websites. Sharing is enabled.

@AlexByte I don't record every data point. I have rate limiting in place as well as some other methods to prevent abuse and deal with the high volume of traffic. There is something wrong with the numbers though, PHP and WooCommerce should certainly not be zero.

@AlexByte I worked out what happened, the totals on that page are now up-to-date again.

@AliasIO What was the problem?

MySQL was struggling with large tables and timing out while trying to calculate the totals. I rebuilt the entire thing in MariaDB and it's blazing fast again.

@AliasIO Some technology has 0 websites in the list. If I visit a site on which this technology is, how quickly should this number increase?
I visited sites with different technologies that are on 0 websites, but the number does not change.

The summaries get updated daily but as I mentioned I'm not collecting every single data point and they need to be corroborated by multiple sources. Lodash is zero because I renamed it from Lo-dash but that should populate probably within a few weeks.

What sources? How many sources do you need to confirm one site for technology?

I don't want to expose all the details but it's not enough for just one user to send information and have it show up on the website. It's to prevent people from poisoning the data with fake requests.

Why did you write that there is no threshold of the number of users? https://github.com/AliasIO/Wappalyzer/issues/1432#issuecomment-341604164

Ha, good point. Wappalyzer has a completely different architecture now so things have changed quite a bit.

Not surprisingly, many technologies have 0 websites, since 85% of detection sendings end in error. It is necessary not to clear the cache if the request was completed with an error and increase the interval between requests (increase > 50), so that there were fewer errors "Too Many Requests" of AWS Lmabda. What is current limit of requests per second in AWS Lambda?

https://github.com/AliasIO/Wappalyzer/blob/a0cc689e1dff9a96baf3d0488433b89d320fb062/src/wappalyzer.js#L202-L209
image

I'm processing 10 requests per second but there is also a per-user limit. I'm not sure why you're seeing that many requests, it should only ping every 50 websites or so. Did you change the code on your end? Increasing the rate and interval both affect my AWS costs, I have to balance it.

I'm not sure why you're seeing that many requests

Because these are requests for a week.

Increasing the rate and interval both affect my AWS costs

Not increase rate. I suggest: fewer request, but with bigger request size (Lambda supports up to 6 MB). Why will prices rise if there are fewer requests?

It is necessary not to clear the cache if the request was completed with an error

What can you say about this?

Increasing the size of the request increases the duration of the function execution and database throughput. I'll experiment with this some more though.

It is necessary not to clear the cache if the request was completed with an error

The cache will just keep growing and a request will be issued on every page load after 50. I think that will result in more issues.

The cache will just keep growing and a request will be issued on every page load after 50. I think that will result in more issues.

You can store the limit of the number of sites in a variable and increase it by 50 if the sending was executed with an error. The cache can be stored in the repository so that when the browser is closed, the detections is not lost.

We can try that.

In general, at the address https://api.wappalyzer.com/ping/v1/, no more than 10 sites are sent, because adCache contains about 40 web pages. You can count the number separately for hostnameCache and adCache. adCache can be not sent at all, why is it needed?
Info about sending adCache:
image

Good call, I've changed it in the latest version.

I'm processing 10 requests per second but there is also a per-user limit.
The cache will just keep growing and a request will be issued on every page load after 50. I think that will result in more issues.

You replaced 50 by 1. In general, I do not understand why you did this, Now when parallel surfing two sites after every page loading (of opposite site) a detections of that two site is sent. You increased the number of requests in several times and worsened the problem many times.
https://github.com/AliasIO/Wappalyzer/blob/2da8ec82d33791d6837d95941dc29d1e04a90947/src/wappalyzer.js#L202-L214

Oh, that was unintentional. I just pushed a stealth update to fix it.

https://github.com/AliasIO/Wappalyzer/commit/e6a9fcae2f04673b4dd2a52d8dc22ae09c6a70a5#diff-d7f544c6575fa5815df4b466a9e04f40

@AliasIO If before there was no threshold of users, then why did 1c-bitrix technology have 0 sites? Is it because of a problem with sending data or before there was some threshold and sending data by one user to the server was not enough?

Throttling was always there, just not on a per-user basis. I made a few optimisations and seem to be capturing a lot more data now, you'll probably notice fewer 429's. We can add 1C-Bitrix back in and monitor it.

What does 429 mean?

@AliasIO In order to add 100 sites to the cache, you need not to close a browser for 4 days.
Previously, site detections was sent after accumulating about 10 sites in the cache.
I believe that you need to save a site cache to the storage.

I used to have it so that it does a ping when you close the browser. I'll look into both options.

You can save site detections to the storage when you close the browser.

@AliasIO hi, added 1C-Bitrix back, please merge PR

You can save site detections to the storage when you close the browser.

Added that in here.

More on topic, the numbers appear to be more accurate now. 1C-Bitrix currently has 50+ detections (thanks @khazamov).

How are detections added if extensions are not updated to return 1c-bitrix?

@alexbyte can you update extensions, since you already took the credit?

On Thu, Jul 5, 2018 at 1:43 AM AlexByte notifications@github.com wrote:

How are detections added if extensions are not updated to return 1c-bitrix?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/AliasIO/Wappalyzer/issues/1432#issuecomment-402568374,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ACcO3j5YImMGvAiXzrNS-YVBZHQuaRWaks5uDUUGgaJpZM4MaxGB
.

--
Thanks,
Omar Khazamov

How are detections added if extensions are not updated to return 1c-bitrix?

Looks like some people are still running an old version with 1C-Bitrix.

@AliasIO Why then these sites were not added earlier?

Was this page helpful?
0 / 5 - 0 ratings

Related issues

KeviinCosmos picture KeviinCosmos  Â·  7Comments

faheel picture faheel  Â·  3Comments

cfjedimaster picture cfjedimaster  Â·  5Comments

smokeyflavor picture smokeyflavor  Â·  8Comments

patheticcockroach picture patheticcockroach  Â·  6Comments